If you are learning Salesforce or preparing for your Salesforce Admin certification, understanding Organization Wide Defaults (OWD) is one of the most critical topics you will encounter. It forms the backbone of Salesforce’s record-level security model — and getting it right can make or break how your entire org’s data is accessed and shared.
In this complete guide, we will walk you through everything you need to know about Organization Wide Defaults in Salesforce: what they are, how they work, the different types, step-by-step setup instructions, best practices, and common interview questions.
Let’s dive in.
Organization Wide Defaults (OWD) in Salesforce are the baseline sharing settings that define the default level of access users have to records they do not own. Think of OWD as the master lock on your organization’s data cabinet — it sets a universal starting point before any additional access is granted through role hierarchies, sharing rules, or manual sharing.
In simpler terms, OWD answers one fundamental question: “If no other sharing rule applies, what can a user see and do with a record they don’t own?”
Every object in Salesforce — Accounts, Contacts, Opportunities, Cases, and Custom objects — can have its own OWD setting configured independently. This gives Salesforce admins granular control over how data flows across the organization.
Key Rule: OWD should always be set to the most restrictive level needed. Other tools like role hierarchies and sharing rules can only open up access — they can never restrict what OWD allows.
Why Are OWDs Important? {#why-are-owds-important}
Organization Wide Defaults are the foundational layer of Salesforce’s entire Data Security model. Here is why they matter:
- Data Privacy: Ensures sensitive records (like financial data or healthcare information) are only accessible to authorized users by default.
- Compliance: Helps organizations meet GDPR, HIPAA, and other data privacy regulations by controlling record visibility.
- Scalability: Instead of setting sharing rules for every single record, one OWD setting applies universally to all records of that object type.
- Control & Flexibility: Combined with role hierarchy, sharing rules, and manual sharing, OWD provides a layered and highly customizable security model.
Types of OWD Settings in Salesforce
Salesforce provides several OWD access levels. The options available depend on the object type (standard vs. custom), but the most commonly used settings are:
1. Private
In the Private setting, only the record owner – and users above them in the role hierarchy – can view or edit the record. No other users have default access.
When to use it: Ideal for highly sensitive data such as patient records, personal financial information, or confidential sales leads where data isolation is critical.
Example: A sales rep can only see their own opportunities. Their manager (higher in the role hierarchy) can see all opportunities belonging to reps below them.
2. Public Read Only
With Public Read Only, all users can view records created by anyone in the org, but they can only edit records they own.
When to use it: Best for reference data that everyone needs to see but only certain people should be able to modify.
Example: All support agents can view a shared knowledge base of articles, but only the team lead can edit them.
3. Public Read/Write
The Public Read/Write setting allows all users to view, edit, and report on all records, regardless of ownership. However, only the record owner can delete the record or change its sharing settings.
When to use it: Suitable for highly collaborative environments where team members frequently work on each other’s records.
Example: All sales reps on a team can edit any account in the org to keep CRM data up to date.
4. Public Read/Write/Transfer
This setting allows all users to view, edit, and also transfer ownership of records. This access level is only available for certain objects such as Cases and Leads.
When to use it: Use when you need customer service teams or lead assignment workflows to freely reassign records.
5. Controlled by Parent
With Controlled by Parent, access to a child record is determined by the OWD of its parent record. Commonly used for objects in a master-detail or lookup relationship.
When to use it: Applied when child records (e.g., Contacts) should inherit access from their parent object (e.g., Accounts).
Example: If a Contact is related to an Account, the user’s access to that Contact is controlled by their access to the parent Account.
Quick Reference Table
| OWD Setting | View | Edit | Delete |
|---|---|---|---|
| Private | Owner + Hierarchy | Owner + Hierarchy | Owner only |
| Public Read Only | All Users | Owner only | Owner only |
| Public Read/Write | All Users | All Users | Owner only |
| Public Read/Write/Transfer | All Users | All Users | Owner only |
| Controlled by Parent | Based on parent | Based on parent | Based on parent |
How to Set Up Organization Wide Defaults in Salesforce
For Standard Objects:
- Log in to your Salesforce org.
- Click the gear icon in the top-right corner and go to Setup.
- In the Quick Find box, type Sharing Settings and click on it.
- Scroll down to the Organization-Wide Defaults section.
- Click Edit.
- Select the desired access level for each object (e.g., Accounts, Contacts, Leads).
- Click Save.
For Custom Objects:
- Go to Setup > Object Manager.
- Click on the custom object you want to configure.
- Scroll to the Optional Features section.
- Under Organization-Wide Defaults, select the desired access level.
- Click Save.
Important Notes After Saving:
- Changes to OWD settings trigger a sharing recalculation across all existing records in the org.
- This process can take up to 2 hours depending on the size of your org.
- Salesforce sends an email notification when the recalculation is complete.
- You can monitor the progress via the Setup Audit Trail.
- New records will adopt the new OWD settings immediately after saving.
How OWD Interacts with Profiles and Permissions
OWD and Profiles are two separate but closely related layers of the Salesforce security model:
The key rule: a user’s access to a record is determined by the more restrictive of the two.
Examples:
- If OWD is Public Read/Write but the user’s profile has Read Only permission on that object, the user can only read records – not edit them.
- If OWD is Private but the user’s profile has Edit permission, the user still cannot access records they do not own unless additional sharing rules are in place.
Bottom line: OWD and profiles both need to allow access for a user to actually gain access. The most restrictive setting always wins.
How Record Access Is Determined in Salesforce
When a user tries to access a record, Salesforce runs through the following checks in order:
- Is the user the record owner? If yes, full access is granted (subject to profile permissions).
- Does a sharing rule grant access? If yes, the most permissive sharing rule applies.
- Does the user’s role hierarchy include the record owner? If yes, the user inherits the owner’s access.
- What are the OWD settings for the object? The default access level is applied.
- What are the user’s object-level permissions (profile)? The most permissive combined permission is used.
If none of these conditions grant access, the user is denied.
OWD and the Salesforce Security Model
Organization Wide Defaults sit at the base of Salesforce’s four-layer record-level security model:
Each layer above OWD can only open up access – not restrict it further. You can selectively expand access using:
- Role Hierarchies: Managers automatically inherit access to records owned by users below them.
- Sharing Rules: Automatically share records with groups of users based on criteria or record ownership.
- Manual Sharing: Record owners or admins can share individual records with specific users or groups.
Best Practices for Managing Organization Wide Defaults
1. Start with the Most Restrictive Setting
Always begin with Private and gradually open up access using role hierarchies and sharing rules. This ensures sensitive data does not accidentally become visible to unauthorized users.
2. Evaluate Sharing Rule Requirements Before Making Changes
Before setting a restrictive OWD like Private, map out the sharing rules you will need to ensure the right teams still have access. This avoids productivity disruptions.
3. Test Changes in a Sandbox First
Never apply OWD changes directly in production without testing. Even small changes can trigger large sharing recalculations and impact thousands of records.
4. Schedule Changes During Off-Peak Hours
Since OWD changes trigger sharing recalculations that can take hours, schedule them during low-traffic periods (e.g., nights or weekends) to minimize impact on users.
5. Monitor Access Regularly
Review your OWD settings and sharing configurations regularly to ensure they align with evolving business needs and compliance requirements.
6. Document Everything
Keep clear documentation of your OWD settings, the rationale behind each decision, and any related sharing rules. This is invaluable when troubleshooting or onboarding new admins.
7. Train Your Users
Ensure your Salesforce users understand why they can or cannot see certain records. Clear communication reduces confusion and helpdesk tickets.
Common Mistakes to Avoid with OWD
Mistake 1: Setting OWD too permissive from the start Starting with Public Read/Write exposes all records to all users, which is a significant security risk for most organizations.
Mistake 2: Forgetting that OWD applies to all existing records OWD changes affect every record in the org, not just new ones. Always consider the impact on historical data.
Mistake 3: Confusing OWD with Profiles Profiles control what objects users can access; OWD controls which specific records they can see within those objects.
Mistake 4: Ignoring the sharing recalculation time Changing OWD in a large org without planning for recalculation time can leave users in a confusing state for hours.
Mistake 5: Not aligning OWD with compliance requirements Organizations in regulated industries must ensure their OWD settings satisfy data protection laws such as HIPAA or GDPR.
Frequently Asked Questions (FAQs)
Q: Can OWD grant more access than a user’s profile allows? No. A user’s access level is always the more restrictive of OWD and their profile permissions.
Q: Can I set different OWD settings for different objects? Yes. OWD is configured per object. You can have Accounts set to Private and Contacts set to Public Read Only simultaneously.
Q: What happens to existing records when I change OWD settings? Salesforce triggers a sharing recalculation that applies the new settings to all existing records. This can take up to 2 hours for large orgs.
Q: Who can change OWD settings in Salesforce? Only users with System Administrator access (or the Manage Sharing permission) can modify Organization Wide Defaults.
Q: Is OWD the same for all Salesforce editions? The availability of certain OWD settings (like Controlled by Parent) can vary depending on your Salesforce edition and object type. Always verify in your org’s Setup.
Ready to Master Salesforce Admin?
Understanding Organization Wide Defaults is just one piece of the Salesforce Admin puzzle. Mastering Salesforce security – including profiles, roles, permission sets, sharing rules, and OWD – is a critical skill that every certified Salesforce Administrator must have.
Enroll in the Salesforce Admin Certification Course
If you are serious about building a career in Salesforce and passing the Salesforce Certified Administrator exam, then you need structured, expert-led training that covers every exam topic from the ground up.
Join the Salesforce Admin Certification Course at MyTutorialRack
Here is what you will get:
- Complete coverage of all Salesforce Admin exam topics, including OWD, sharing settings, security model, and more
- Hands-on practice with real-world Salesforce scenarios
- Step-by-step guidance from industry-experienced instructors
- Exam-focused content to help you pass the Salesforce Admin certification on your first attempt
- Lifetime access to course materials and updates
Whether you are a complete beginner or an IT professional looking to add Salesforce to your skill set, this course gives you everything you need to succeed.
